Azure Management and governance built-in role

Site Recovery Operator

Executes and manages Site Recovery test failover, failover, reprotection, and failback operations without enabling or disabling replication, registering new infrastructure, creating or deleting vaults, or assigning access. It has no DataActions.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 494ae006-db33-4328-bf46-533a6560a3ca

Control-plane actions (59)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign at the Recovery Services vault containing the protected items and recovery plans the operator may run. Target compute, network, storage, and resource-group permissions required by the recovery operation remain separate.

Common use cases (2)

Prerequisites (2)

Best practices (2)

Security considerations (2)

Assignment guidance

Assign to trained DR operators at the vault, preferably as eligible access activated for drills or incidents. Keep replication configuration on Contributor and monitoring on Reader.

Related roles (2)

Common questions

When should I assign the Site Recovery Operator Azure role?

Assign Site Recovery Operator when you need to: Run a planned or unplanned failover when instructed during an incident or disaster-recovery drill.; and Reprotect and fail back recovered virtual machines after the primary site is restored.. Practical scope: Assign at the Recovery Services vault containing the protected items and recovery plans the operator may run. Target compute, network, storage, and resource-group permissions required by the recovery operation remain separate.

What permissions does the Site Recovery Operator Azure role grant?

The role definition grants 59 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Network/virtualNetworks/read; Microsoft.RecoveryServices/locations/allocatedStamp/read; Microsoft.RecoveryServices/locations/allocateStamp/action; and Microsoft.RecoveryServices/Vaults/extendedInformation/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Site Recovery Operator Azure role?

Key considerations when assigning Site Recovery Operator: Failover and failback can redirect production workloads, create target resources, expose recovered systems, or cause outage and data divergence.; and The role is narrower than Contributor for configuration, but its recovery execution authority remains highly privileged.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (5)

Official Microsoft Learn documentation →